I was one of three internal auditors working at Solitaire Bank's Kolkata regional office. Our team was responsible for the audit and compliance functions of 234 retail branches. My fellow auditor, Rakesh, and I used to travel from one branch to another to perform auditing work. One day we were on a train to a visit a branch in Patna when — the moment the train started moving — the regional audit manager called my cell phone and said that our branch in Bihta received a complaint from a high-net-worth customer that an unauthorized debit of $200,000 was transferred from his account through the Internet-banking system. He wanted me to go to the Bihta branch and do a quick review of the case. I left Rakesh in charge of the Patna audit and took the first train to Bihta.

When I arrived at the Bihta branch, the first thing I noticed was the size. There were only 10 employees, but it was a very profitable branch because there was a rich local cashew market in the area. I met with the branch manager, Gopal, over coffee and learned that the customer who lodged the complaint did not know why $200,000 was debited from his account. The complaint was sent via e-mail and had come only to the branch manager. The customer's complaint said:

We had provisions at Solitaire that if a customer was erroneously debited, he was given the interest he would have earned and an acknowledgment of the mistake. It was sent with a letter of apology from the branch, which was also required to post an error-rectification entry to the customer's account when these actions were taken. I generated a report of the error-rectification entries posted by the Bihta branch in the last year and was surprised that there were only four entries and none pertained to the account in question. I asked for copies of the apologies sent to the customers and, adding to my confusion, I was told that there were none on file for the year. Something was fishy.

I started looking into the statements for the customer and discovered that two or three times a month Internet-banking transactions were originated from his account to the Bangalore branch and then reversed before the end of the day — without an explanation.

After scrutinizing the Bangalore account that was receiving the transfers I could not believe the entries. Each day there were Internet transfers into the account totaling no less than $1 million. They were from several Solitaire accounts, and were reversed before the end of the day without documentation. In addition to the deposits, there was one debit transferred out of the Bangalore-based account every day and credited to an Internet-trading account. The value of the debit equaled the total amount of credits made from various Solitaire customers' accounts. As Solitaire's corporate auditor, I had access to the reports and account statements from the bank. I generated a printout of the Internet-trading account in Bangalore, which showed that the account had income of $750,000 in last six months.

I looked up the personal details on the trading account and called the contact number on file; the phone was answered by a kind-sounding woman. When I said that I was calling from Solitaire Bank, she asked me to get in touch with her husband, Samuel Ghosh, who was the assistant manager at the Bihta branch. She told me that he had opened the trading account to buy mutual funds for tax benefits and that Samuel handled the transactions.

Shocked that the assistant branch manager was apparently behind the offense, I scheduled an interview with Samuel Ghosh. He was a successful assistant manager and enjoyed good relationships with each department of the bank. His superiors were happy with his work and he was respected by his subordinates. I, too, had shared their feelings about him — we had gone on business lunches together several times. Sam had a keen understanding of Solitaire's controls and was even considered for an internal audit position at one time.

As an assistant branch manager, Samuel had access to customer information and he knew that the default usernames for Internet banking accounts were the customers' identifications. If customers forget their passwords, they could create new ones online. While changing their passwords, the customers were given a verification call on the phone number listed in the bank's records. This number could be changed online by an employee to ensure the bank had the most up-to-date information. As the result of a systemic limitation, there was no audit trail of such changes made by employees. Samuel knew that if he changed a customer's contact number to his personal cell phone, a Solitaire employee would call him to confirm changes made to the Internet-banking password associated with that account. This allowed him to change customers' passwords, confirm the changes through his cell phone and then access online accounts using passwords of his choice.

After transferring funds from customers' online accounts to his trading account, he would attempt to log into the victims' accounts incorrectly three times to exploit another feature of the Solitaire system — three incorrect login attempts disabled the password. Therefore, the next time a victim customer tried to access his account online, he would be prompted to create a new password. Samuel also replaced the original contact number in the online records after transferring the funds, so the customer received the second confirmation call from the bank. Samuel usually posted transactions under $50,000 because he knew there was no oversight process for Internet transfers below that threshold.

Samuel chose high-net-worth customers who held large balances. When the customers complained of erroneous debits, he reversed the transaction and credited the amount back to the account before the end of the day because those were not checked and there was no tool to generate a report. Samuel knew the control limitations and exploited them to his advantage. However, he was caught when the market collapsed — he lost too much money in his trading account in one day and could not afford to transfer the funds back to the customer's online account. After trying to reach Samuel multiple times with no response, the customer contacted the branch manager to complain.

After understanding the process behind the scam, I asked Samuel if he would meet with me for a discussion over tea. When I brought up the transfers to his personal account, he initially claimed that he and his friends had a profit-sharing agreement for the proceeds of the trading activity. When I smiled and said I was going to have to call his friends to confirm his statement, he broke down and confessed. It was one of the easiest confessions in my career. I asked him, "Sam, you were such an excellent banker. Why did you do it?"

He looked at me and put his cup on the table. He was silent for a minute and then mumbled, "Money has such a crazy nature; it started with my part-time brokerage firm assignment. While working there, I realized my clients made huge sums of money based on my recommendations. Why couldn't I do the same? I started doing day-trading with my small savings but quickly realized that to make the big money I needed to start my own company; I needed significant funds to do serious trading. I started smurfing by taking small amounts of money from a lot of different accounts to amass a large sum. I became greedy and thought it was easy to make money that way. I felt justified because I was a critical member of the management team and was not being fairly compensated. I also figured that I was not harming the bank or any clients. I was just borrowing the funds for six or seven hours a day; I always gave the money back at the end of the day."

I could see the regret on Samuel's face. I asked, "Did you only do it to earn money to start your own business? Did you have other reasons?" He looked at me and tears welled up in his eyes. "Are you okay?" I asked, pushing a glass of water toward him. He gulped half of the glass and looked into my eyes, but didn't say anything more. I told him that I would have to refer the matter, along with my detailed report, to the legal department. He uttered in a choked voice, "I understand; I have even sent a few cases of fraud to the legal department myself. Nothing can be done; I do not expect anything now."

There was a silence for while. He started to speak again, "My wife had no faith in my dreams, and she used to ask why I wanted a brokerage firm. She would say, 'Can't you be satiated in life? We both have good jobs with handsome salaries. We have a beautiful house; what else you want?' I was so lonely and frustrated that I lost my ability to differentiate between right and wrong. The only thing on my mind was to get enough money together to start my firm and show everyone who did not believe in me that I could do it."

I asked him why he didn't mention his goal to a senior bank official. I suggested that he might have been able to get a loan from Solitaire to start the business, but he responded, "Who has time to hear about my project? This organization is driven by deposit targets. We have to work 24/7 to meet them, and people here are only concerned with performance, which is judged by strict parameters."

His comment gave me insight into Solitaire's corporate culture. We were so engrossed in our work routines and tough competition that we forgot that our performance was driven by people. I realized that the psychological satisfaction of our employees was essential element in preventing internal frauds.

After gathering the documentation and Samuel's written confession, I turned over the evidence to Solitaire's legal department. After reviewing the report and evidence, management and our lawyers terminated Samuel and passed the case to law enforcement. Samuel was eventually sentenced to two years in prison. The last I heard of him, he had been released and moved in with parents in his childhood village to learn farming.

Shabda Prakash is a risk manager at a financial institution. He has experience in retail banking, wholesale banking, corporate banking, financial operations, retirement planning services operations and investment banking.